Azure / Azure/DevOps-Self-Hosted

[Pipeline issue] - Adapt the pipeline to subscription id for the environment (ability to change scope)

Open
#15 1 comment 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
PowerShell
Stars
74
Forks
26
Avg merge
10d 9h
Merged PRs (30d)
1

Description

The current bug isn't adapted for customers that would like to deploy self-hosted agents to different environments as part of their CI/CD pipeline strategy. Both `pipeline.image.jobs.yml` and `pipeline.scaleset.jobs.yml` files doesn't include specific variables for each environment, which doesn't allow good re-use of code. This leads to the pipeline wanting to deploy out to the default subscription in which the SPN is set to. This means that in order to move forward, the `.azuredevops` folder needs to adapt for variables for different scopes.

Steps to reproduce the behaviour:
1. While setting up the Self-hosted agent IPkit in your own environment, try deploying to 3 different subscriptions - where each subscription will be dedicated to deploying to sandbox, dev and prod environments.
2. Ensure that you have setup ready where each parameters file will be deployed to a different scope with their associated bicep file (either in the Azure Image builder or VMSS creation pipeline)
4. Then, try to deploy the infrastructure or image using the service connection provided.
5. The following error will pop up:
WARNING: The client '15041bef-fcd3-XXXX-XXXX-XXXXXXXXXXXX' with object id '15041bef-XXXX-XXXX-XXXXXXXXXXXX' does not have authorization to perform action 'Microsoft.Resources/deployments/validate/action' over scope '/subscriptions/ac084e26-de58-XXXX-XXXX-XXXXXXXXXXXX' or the scope is invalid. If access was recently granted, please refresh your credentials.

This illustrates that the default client and associated object id doesn't have the relevant permissions over the default subscription.

I would like to have the self-hosted agents to be able to be deployed to different scope, specifically subscriptions, therefore could we please create variables to allow for this flexibility and update the specific areas of code, specified in the screenshot. I have also included the screenshots to solutions for this issue. In my particular case, the dev service connection should be deploying to the dev subscription and same for production,

If applicable, add screenshots to help explain your problem.

- OS: Windows 11
- Browser Microsoft Edge
- Version: Latest

Happy to fix this issue myself by becoming a contributor to this IPKit.

Problem example:
image

Problem solution:

image

image

image

Contributor guide

Open the contributing guide

Research direction

Start with `.azuredevops/pipeline.image.jobs.yml` and `.azuredevops/pipeline.scaleset.jobs.yml`, then inspect the other variables and parameter files in `.azuredevops`. Reproduce the deployment across sandbox, dev, and production subscriptions and trace how each service connection and subscription scope is selected. Done means each environment can deploy to its associated subscription without targeting the default subscription.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
ci-cd, cloud, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.